BisonFTP Discloses User Passwords to Local Users
|
|
SecurityTracker Alert ID: 1007462 |
|
SecurityTracker URL: http://securitytracker.com/id/1007462
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Aug 11 2003
|
Impact:
Disclosure of authentication information
|
Exploit Included: Yes
|
Version(s): 3.5.1.193
|
Description:
CyberTalon reported an authentication information disclosure vulnerability in BisonFTP. A local user can view user passwords for the FTP server.
It is reported that the server stores user passwords in the Windows registry in the following location:
HKEY_CURRENT_USER\Software\BisonWare\BisonFTP3\Users
A local user can view user passwords.
It is also reported that, in the default configuration, the 'anonymous' account is enabled with full privledges.
|
Impact:
A local user can view user passwords.
|
Solution:
No solution was available at the time of this entry.
|
Cause:
Access control error
|
Underlying OS:
Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 11 Aug 2003 02:00:52 -0300
Subject: Bisonware FTP Server 3.5.1.193 Local Vulnerabilities
|
Bisonware FTP Server 3.5.1.193 Local Vulnerabilities
Found by: CyberTalon
-------------------------------------------------------------------------
1. Intro
2. Problem1
3. Problem2
4. Solutions
5. Ending
6. Info
-------------------------------------------------------------------------
1. I have found some local vulnerabilities in Bisonware FTP Server
3.5.1.193.
-------------------------------------------------------------------------
2. By default, an anonymous account is enabled with full privledges on the
server, with no password.
-------------------------------------------------------------------------
3. The user passwords are stored in the binary data decoded by regedit. it
is stored in:
HKEY_CURRENT_USER\Software\BisonWare\BisonFTP3\Users
Right-click a user and select Modify. Look at the binary decodings to the
right, in there will be the username and alittle below it is the password.
-------------------------------------------------------------------------
4. For 2., in future versions, disable all accounts by default. As a user
fix, ust add a password, delete the account, or secure it another way.
For 3., they need to use encryption when storing passwords.
-------------------------------------------------------------------------
5. These can be serious local vulnerabilities when exploited, and need to be
fixed.
-------------------------------------------------------------------------
6. Vendor URL: Unknown
-CT
_________________________________________________________________
Add photos to your e-mail with MSN 8. Get 2 months FREE*.
http://join.msn.com/?page=features/featuredemail
|
|
